599b40aa7b210e6c8204c658da233a7bfe8d3f144860a93a4db498b69969679e

Analysis

max time kernel
150s
max time network
119s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
15-03-2024 21:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Gruel.exe
Size

100KB
MD5

b0feccddd78039aed7f1d68dae4d73d3
SHA1

8fcffb3ae7af33b9b83af4c5acbb044f888eeabf
SHA256

5714efd4746f7796bbc52a272f8e354f67edfb50129d5fdaa1396e920956d0d6
SHA512

b02b9476eeb9c43fcfef56949f867c1c88f152d65f3961a2838b8bff02df2383945aefb9a8c517ac78d79b5a9163c7677f5b6238f4624b1966994c9c09eb428d
SSDEEP

1536:ThBfyxwMz14BSSQGRwmkwmGDAzGC6TaPAlbv/g:1BKxwMz14wSQGGUDAATaPAlbv/g

Score

7^/10

persistence

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 5 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

Processes:

Gruel.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Gruel.exe\" %1"	Gruel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Gruel.exe\" %1"	Gruel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Gruel.exe\" %1"	Gruel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Gruel.exe\" %1"	Gruel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Gruel.exe\" %1"	Gruel.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Gruel.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MediaPath = "C:\\Rundll32.exe"	Gruel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Rundll32 = "C:\\Rundll32.exe"	Gruel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnceEX\DevicePath = "C:\\Rundll32.exe"	Gruel.exe

Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

Gruel.exe

description ioc process

File opened (read-only) \??\D: Gruel.exe
Drops file in Windows directory 1 IoCs

Processes:

Gruel.exe

description ioc process

File created C:\windows\Program Files\Kazaa\My Shared Folder\Norton 2003 Pro.exe Gruel.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File opened (read-only)	\??\D:	Gruel.exe

description	ioc	process
File created	C:\windows\Program Files\Kazaa\My Shared Folder\Norton 2003 Pro.exe	Gruel.exe

Modifies Control Panel 3 IoCs

evasion

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Control Panel\Appearance\Schemes	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Control Panel\Desktop	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Control Panel\Desktop\Pattern Upgrade = "TRUE"	rundll32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

Gruel.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "kIlLeRgUaTe 1.03, I mAke ThIs vIrUs BeCaUsE I dOn'T hAvE NoThInG tO dO!!"	Gruel.exe

Modifies registry class 29 IoCs

Processes:

Gruel.exeGruel.exeGruel.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\Shell	Gruel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\Shell\Open	Gruel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\Shell\Open\Command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Gruel.exe\" %1"	Gruel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}	Gruel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\Shell\Open\Command	Gruel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\ShellEx\PropertySheetHandlers\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}	Gruel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\ShellEx\PropertySheetHandlers	Gruel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Gruel.exe,0"	Gruel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Gruel.exe\" %1"	Gruel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\DefaultIcon	Gruel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	Gruel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\Shell\Open\Command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Gruel.exe\" %1"	Gruel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\ShellEx	Gruel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\InfoTip = "kIlLeRgUaTe 1.03"	Gruel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Gruel.exe\" %1"	Gruel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htafile\Shell\Open\Command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Gruel.exe\" %1"	Gruel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Gruel.exe,0"	Gruel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\InProcServer32	Gruel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	Gruel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\ShellFolder	Gruel.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\ShellFolder\Attributes = 00000000	Gruel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\ = "kIlLeRgUaTe 1.03"	Gruel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\InProcServer32\ = "Shell32.dll"	Gruel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Gruel.exe\" %1"	Gruel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Gruel.exe\" %1"	Gruel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\InProcServer32\ThreadingModel = "Apartment"	Gruel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Gruel.exe\" %1"	Gruel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\Shell\Open\Command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Gruel.exe\" %1"	Gruel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8C6D8BD6-116B-4D4E-B1C2-87098DB509BB}\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Gruel.exe,0"	Gruel.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

Gruel.exe

pid process

2924 Gruel.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

Gruel.exeGruel.exeGruel.exe

pid process

2924 Gruel.exe
2672 Gruel.exe
2452 Gruel.exe

pid	process
2924	Gruel.exe

pid	process
2924	Gruel.exe
2672	Gruel.exe
2452	Gruel.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Gruel.exerundll32.exerundll32.exerundll32.exe

description	pid	process	target process
PID 2924 wrote to memory of 2700	2924	Gruel.exe	rundll32.exe
PID 2924 wrote to memory of 2700	2924	Gruel.exe	rundll32.exe
PID 2924 wrote to memory of 2700	2924	Gruel.exe	rundll32.exe
PID 2924 wrote to memory of 2700	2924	Gruel.exe	rundll32.exe
PID 2924 wrote to memory of 2700	2924	Gruel.exe	rundll32.exe
PID 2924 wrote to memory of 2700	2924	Gruel.exe	rundll32.exe
PID 2924 wrote to memory of 2700	2924	Gruel.exe	rundll32.exe
PID 2924 wrote to memory of 2676	2924	Gruel.exe	rundll32.exe
PID 2924 wrote to memory of 2676	2924	Gruel.exe	rundll32.exe
PID 2924 wrote to memory of 2676	2924	Gruel.exe	rundll32.exe
PID 2924 wrote to memory of 2676	2924	Gruel.exe	rundll32.exe
PID 2924 wrote to memory of 2676	2924	Gruel.exe	rundll32.exe
PID 2924 wrote to memory of 2676	2924	Gruel.exe	rundll32.exe
PID 2924 wrote to memory of 2676	2924	Gruel.exe	rundll32.exe
PID 2676 wrote to memory of 2748	2676	rundll32.exe	RunDll32.exe
PID 2676 wrote to memory of 2748	2676	rundll32.exe	RunDll32.exe
PID 2676 wrote to memory of 2748	2676	rundll32.exe	RunDll32.exe
PID 2676 wrote to memory of 2748	2676	rundll32.exe	RunDll32.exe
PID 2924 wrote to memory of 2776	2924	Gruel.exe	rundll32.exe
PID 2924 wrote to memory of 2776	2924	Gruel.exe	rundll32.exe
PID 2924 wrote to memory of 2776	2924	Gruel.exe	rundll32.exe
PID 2924 wrote to memory of 2776	2924	Gruel.exe	rundll32.exe
PID 2924 wrote to memory of 2776	2924	Gruel.exe	rundll32.exe
PID 2924 wrote to memory of 2776	2924	Gruel.exe	rundll32.exe
PID 2924 wrote to memory of 2776	2924	Gruel.exe	rundll32.exe
PID 2924 wrote to memory of 2920	2924	Gruel.exe	rundll32.exe
PID 2924 wrote to memory of 2920	2924	Gruel.exe	rundll32.exe
PID 2924 wrote to memory of 2920	2924	Gruel.exe	rundll32.exe
PID 2924 wrote to memory of 2920	2924	Gruel.exe	rundll32.exe
PID 2924 wrote to memory of 2920	2924	Gruel.exe	rundll32.exe
PID 2924 wrote to memory of 2920	2924	Gruel.exe	rundll32.exe
PID 2924 wrote to memory of 2920	2924	Gruel.exe	rundll32.exe
PID 2924 wrote to memory of 1452	2924	Gruel.exe	rundll32.exe
PID 2924 wrote to memory of 1452	2924	Gruel.exe	rundll32.exe
PID 2924 wrote to memory of 1452	2924	Gruel.exe	rundll32.exe
PID 2924 wrote to memory of 1452	2924	Gruel.exe	rundll32.exe
PID 2924 wrote to memory of 1452	2924	Gruel.exe	rundll32.exe
PID 2924 wrote to memory of 1452	2924	Gruel.exe	rundll32.exe
PID 2924 wrote to memory of 1452	2924	Gruel.exe	rundll32.exe
PID 1452 wrote to memory of 2672	1452	rundll32.exe	Gruel.exe
PID 1452 wrote to memory of 2672	1452	rundll32.exe	Gruel.exe
PID 1452 wrote to memory of 2672	1452	rundll32.exe	Gruel.exe
PID 1452 wrote to memory of 2672	1452	rundll32.exe	Gruel.exe
PID 1452 wrote to memory of 2672	1452	rundll32.exe	Gruel.exe
PID 1452 wrote to memory of 2672	1452	rundll32.exe	Gruel.exe
PID 1452 wrote to memory of 2672	1452	rundll32.exe	Gruel.exe
PID 2924 wrote to memory of 2532	2924	Gruel.exe	rundll32.exe
PID 2924 wrote to memory of 2532	2924	Gruel.exe	rundll32.exe
PID 2924 wrote to memory of 2532	2924	Gruel.exe	rundll32.exe
PID 2924 wrote to memory of 2532	2924	Gruel.exe	rundll32.exe
PID 2924 wrote to memory of 2532	2924	Gruel.exe	rundll32.exe
PID 2924 wrote to memory of 2532	2924	Gruel.exe	rundll32.exe
PID 2924 wrote to memory of 2532	2924	Gruel.exe	rundll32.exe
PID 2924 wrote to memory of 2424	2924	Gruel.exe	rundll32.exe
PID 2924 wrote to memory of 2424	2924	Gruel.exe	rundll32.exe
PID 2924 wrote to memory of 2424	2924	Gruel.exe	rundll32.exe
PID 2924 wrote to memory of 2424	2924	Gruel.exe	rundll32.exe
PID 2924 wrote to memory of 2424	2924	Gruel.exe	rundll32.exe
PID 2924 wrote to memory of 2424	2924	Gruel.exe	rundll32.exe
PID 2924 wrote to memory of 2424	2924	Gruel.exe	rundll32.exe
PID 2424 wrote to memory of 2452	2424	rundll32.exe	Gruel.exe
PID 2424 wrote to memory of 2452	2424	rundll32.exe	Gruel.exe
PID 2424 wrote to memory of 2452	2424	rundll32.exe	Gruel.exe
PID 2424 wrote to memory of 2452	2424	rundll32.exe	Gruel.exe

C:\Users\Admin\AppData\Local\Temp\Gruel.exe
"C:\Users\Admin\AppData\Local\Temp\Gruel.exe"
1⤵
- Modifies system executable filetype association
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2924

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe shell32.dll,Control_RunDLL mmsys.cpl @1
2⤵
PID:2700

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe shell32.dll,Control_RunDLL netcpl.cpl
2⤵
- Suspicious use of WriteProcessMemory
PID:2676

C:\Windows\system32\RunDll32.exe
C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL netcpl.cpl
3⤵
PID:2748

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe shell32.dll,Control_RunDLL mmsys.cpl,,0
2⤵
PID:2776

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe shell32.dll,Control_RunDLL main.cpl @0
2⤵
PID:2920

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe shell32.dll,Control_RunDLL modem.cpl
2⤵
- Suspicious use of WriteProcessMemory
PID:1452

C:\Users\Admin\AppData\Local\Temp\Gruel.exe
"C:\Users\Admin\AppData\Local\Temp\Gruel.exe" C:\Windows\system32\rundll32.exe
3⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2672

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe shell32.dll,Control_RunDLL main.cpl @1
2⤵
PID:2532

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe shell32.dll,Control_RunDLL sysdm.cpl @1
2⤵
- Suspicious use of WriteProcessMemory
PID:2424

C:\Users\Admin\AppData\Local\Temp\Gruel.exe
"C:\Users\Admin\AppData\Local\Temp\Gruel.exe" C:\Windows\System32\SystemPropertiesComputerName.exe
3⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2452

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe shell32.dll,Control_RunDLL appwiz.cpl,,1
2⤵
PID:1648

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe shell32.dll,Control_RunDLL timedate.cpl
2⤵
PID:2896

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe shell32.dll,Control_RunDLL desk.cpl,,0
2⤵
- Modifies Control Panel
PID:2408

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe shell32.dll,Control_RunDLL inetcpl.cpl,,0
2⤵
PID:2132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Rundll32.exe

Filesize
100KB

MD5
b0feccddd78039aed7f1d68dae4d73d3

SHA1
8fcffb3ae7af33b9b83af4c5acbb044f888eeabf

SHA256
5714efd4746f7796bbc52a272f8e354f67edfb50129d5fdaa1396e920956d0d6

SHA512
b02b9476eeb9c43fcfef56949f867c1c88f152d65f3961a2838b8bff02df2383945aefb9a8c517ac78d79b5a9163c7677f5b6238f4624b1966994c9c09eb428d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\Custom.theme

Filesize
1KB

MD5
159bd6a587f370f16522b2a6f690bcc3

SHA1
c07d14fc439997e2f65b982c0702a985b36b9cf8

SHA256
9193c9b28f4e19c5fbd00340dce578825fbc6ce6ab67b1c9082c0d8f64446993

SHA512
a1ddc058193d778b3935ef8f158bb06f014de72124d5561a4d7af99e77921bcfe5ffcb24a1375917d5e438e0f2a1dccb96c1bdc2fa5b6aaf75ca5cabe1788e46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\Custom.theme

Filesize
1KB

MD5
d835de730c2496708378bf3dce10892e

SHA1
591faf986469a03f8d46f5b53a3ebf1eaa67a1c7

SHA256
2157e9cd768423a4c6a6532cc34fa1b40e9766ee41dad15a7266474c57095bc1

SHA512
a97e55f7196ffab77e1301884908008cd3c0b10fdf4aa48b120060cb26f911f90a3a0a424e38998974aa874776d7442ba8fdce7128fbbddac5e3fce6c3c7ecc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\Custom.theme

Filesize
1KB

MD5
7c048eaacd1820ac933dccc0b872fa05

SHA1
955999eb7463f7e4031d551e24fbd1e1fb812197

SHA256
614d7a9ca519b3aa741a512e95f6f99aedd25e8c1630d30d13dd9735b562b3be

SHA512
09f35a1a69344e64b13f0a54ecc82cd7dd1ee9124bfc274fcd5fe8af2a07e30bbf0841d9230591cbbe12bc8f066f5f36e1577b82d5d1f3f0eb6b9b5154ce5d4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\Custom.theme

Filesize
1KB

MD5
05471356f0ea1c0f5f5b8deb29c3ebd1

SHA1
12b14b737d1e0f76ca2494fb7a6841e5792a0504

SHA256
cf59479c75a8803468dd2a2c1d2803a2694c41992d5a0b3b65b1c69c28d1eac7

SHA512
942285259612792c2b3a45a65483e0775314841e397e815d447fd8f69f63f5de1ac48653a051c0121bd73415655c468772d39ce72bb1ba3d8ae367f78143502b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\Custom.theme

Filesize
1KB

MD5
b65aeb1b3da0b96313cc6e10dde4afe0

SHA1
34039989280d6d5a45793deaab79665c79b74b8d

SHA256
0254d776e25aeb83f195aacc7d477cd37683932586b27fdb7f09836d08296a3c

SHA512
be5c22848ee3491061feaab9c8e708e04e5d34bc0d8b46e816e059e6616c0114cfe5f40aee935f9d5dee546a990efa3bca00bdec03bcc29fedad37d0dbda95ea

Download Submit